Data Analytics for Travel and Entertainment (T&E) Auditing. Robert Luu, Senior Solutions Consultant, ACL Date: September 27, 2016.

Transcription

1 Data Analytics for Travel and Entertainment (T&E) Auditing Presented by: Steve Dirks, Senior Account Executive, ACL Robert Luu, Senior Solutions Consultant, ACL Date: 2 Opening Remarks Moderator R. Kinney Poynter Executive Director NASACT Speaker Steve Dirks Senior Account Executive ACL Speaker Robert Luu Senior Solutions Consultant ACL

2 Agenda Introductions Market Trends and Risks in T&E Auditing Analysis Techniques (Data and Process) Follow up Actions and Remediation Value-Add Partnership (Audit and Management) Summary Q & A ACL s Vision Our vision is a world where audit, risk and compliance professionals are an organization s most sought after people 4

3 Market Trends & Risks in T&E Auditing CFO.com 2016 Expense Management Trends

4 CFO.com 2016 Expense Management Trends Transactional electronic data is available in 90%+ of organizations CFO.com 2016 Expense Management Trends

5 Risk - Abuse of Power The former chief executive officer of a local electric utility is facing up to 20 years in prison after pleading guilty to fraud. The Office of U.S. Attorney Josh Minkler says Donnis Mizelle is accused of stealing $500,000 from Avon-based Hendricks Power Cooperative over the course of six years. Mizelle is alleged to have "routinely" used company funds like a personal expense account, racking up charges that were tabbed as business expenses, but included purchases such as a $650 bracelet and pen from a local jewelry store and $1,250 for train travel on a family trip to Europe. Minkler says "CEOs hold positions of special trust and authority, not only in the companies they serve but as leaders in society. We expect them to act with integrity. Exploiting that special trust for personal gain is an egregious crime, especially when those defrauded are friends and neighbors in a community that the CEO was hired to serve." The filings accuse Mizelle of submitting false expense reports "on an almost monthly basis," receiving reimbursements for such things as iphones and ipads, sports tickets, clothing, meals and groceries. Risk - Compromising the Public s Trust The speaker of the B.C. legislature Linda Reid charged taxpayers thousands of dollars to fly her husband to South Africa last August while she was attending the Commonwealth Parliamentary Conference. B.C. Liberal MLA Linda Reid's tweeted this picture of her husband relaxing with a giraffe in South Africa after taxpayers paid thousands for his business-class ticket. (Linda Reid/Twitter) She later admitted that her husband's travels costs amount to roughly $5,500 and that she would repay it. B.C. Finance Minister Mike de Jong says scrutiny over Reid's expenses is appropriate because the public is entitled to know how its dollars are being spent. "Politicians have to ask themselves whether or not the money, the public dollars that they are spending, are being spent in a defensible manner," he said.

6 Risk - Reputational Risk A former Mississippi State University employee is facing embezzlement charges, State Auditor Stacey Pickering announced Wednesday. Susan Holder, 63, surrendered to the Oktibbeha County Sheriff's Office on Friday, following her indictment, according to a news release. She is accused of submitting duplicate travel expenses for $35, between September 2007 and October 2011, getting those reimbursed by both the university and a private foundation, the news release said. How does this impact alumni donations? 12 Polling Question 1 of 2 For individuals: Please be sure to answer the polling questions as they are also your attendance checks for today s webinar. For groups: Please answer in a way that reflects the consensus of the group. Attendance for groups is still monitored via the sign-in sheet. Don t forget to send in your questions!

7 Trends in T&E Auditing Increasing Transparency in Public Sector

8 Early Warning System A well-defined T&E Audit program requires a fully optimized end-to-end monitoring solution with correct oversight at key process checkpoints. Continuous Auditing solution with configurable analysis Red-flag indicators with review checkpoints Alerts & Exceptions Actionable and feedback mechanisms Data-Driven Continuous Auditing: Early Warning System Useful Data Objectives > Criteria > Risk > Frequency > Data Requirements ERP Pyrll HR Risk X Big Data Data-Driven Continuous Auditing Data extraction Analytics & Analysis Alerts & exceptions Remediation Eliminate false-positives

9 Analytics Capability Model Repeatable More consistent, repeatable processes Managed Performance metrics for process adjustment Defined Consistent standards, documented processes Optimizing Continuous improvement Initial Inconsistent, ad-hoc processes Source: Adapted from Carnegie Mellon University Risk-based Approach for Analytic Selection Human error in data input (duplicates / data completeness and accuracy) Potential fraudulent transactions Compliance requirements not enforced by application controls Analytic assignment Corporate cards are used for non-business purpose (abuse of company funds) Corporate cards are used as Purchase Cards to go around procurement policies Analytic objectives Risk analysis (control and inherent) Analytic selection Out of pocket transactions abuse by employees Expense reports not submitted on time Analytic prioritization T&E policy is not properly enforced (spending limits, flight class travel, meal reimbursement) Design Development Implementation

10 Analysis Techniques (Data and Process) Continuous Auditing for T&E ID Analytic Frequency CC01 Improperly Classified Late Payment Charges Weekly CC02 Non-business and questionable transactions Weekly CC03 Credit / refund transactions Monthly CC04 Abuse of cash advances Monthly CC05 Abuse of out-of-pocket expenses Monthly CC06 <integrated to CC02> CC07 Personal usage of corporate credit cards Monthly CC08 Old transactions not submitted by user Monthly CC09 Old expense report not submitted by user Monthly CC10 Wrongly classified expenses Monthly CC11 Duplicate Expense Claims Weekly CC12 Expense reports claimed for sensitive accounts Weekly CC13 Expense claims with unusual amounts Weekly CC14 Potential split of credit card charge Monthly Design Development Implementation

11 Source data challenges and solutions Data request Prepared based on functional requirements. Scope exclusions Analytic logic performance Exception elements requested Potential future analytics expansion Document should contain detailed definition of all data extracts required for analytics. Design Development Implementation Source data challenges and solutions Source system Data should be provided from systems being closest to point of data entry Extracts responsibility for interface and extracts relies on other team any changes involving adjustment of source data last much longer require involvement of several teams and increased funding. Direct access to data allows for direct control over source data generation process required data SME and understanding of database table layout and content Design Development Implementation

12 Analytic Development Best Practices Technical documentation Script commentary Interface controls completeness, timeliness, accuracy Source data file handling approach Historical data Repeated results control Logical separation of scripts (import and analytics) Analytics parametrization Design Development Implementation 24 Polling Question 2 of 2 For individuals: Please be sure to answer the polling questions as they are also your attendance checks for today s webinar. For groups: Please answer in a way that reflects the consensus of the group. Attendance for groups is still monitored via the sign-in sheet. Don t forget to send in your questions!

13 Follow Up Actions and Remediation Value-Add Partnership (Audit and Management) Remediation Process Ownership Analysis Owner (Audit) Control Owner (Management) Definition of functional requirements. User Acceptance Testing. Establishing work instructions Timely and thorough exception resolution. User s assignment and supervision of exception resolution process. Continuous improvement of analytic and resolution process Users that are involved in creation, update or approval of elements being subject of automatic control should not be the one resolving exceptions. (Segregation of Duties) Clearly defined responsibility regarding exception resolution. Direct influence over all users

14 Remediation process Ownership CFO.com 2016 Expense Management Trends

15 Remediation process exceptions tracking Track exceptions resolution process with 5 KPI s allowing to quickly see what s the status of it per area and analytic. Total count of exceptions Average Time to Resolve Exceptions Percentage of confirmed exceptions Average Age Of Unresolved Exception Total backlog of exceptions In Summary

16 In Summary - ACL Essentials In Summary

17 In Summary In Summary

18 Q&A Robert Luu, Senior Solutions Consultant, ACL Steve Dirks, Senior Account Executive, ACL Questions and Answers Moderator R. Kinney Poynter Executive Director NASACT Speaker Steve Dirks Senior Account Executive ACL Speaker Robert Luu Senior Solutions Consultant ACL